Add latest changes from gitlab-org/gitlab@master

app/assets/javascripts/groups/components/overview_tabs.vue

@@ -241,6 +241,7 @@ export default {
               class="gl-w-full"
               dropdown-class="gl-w-full"
               data-testid="group_sort_by_dropdown"
+              block
               :text="sort.label"
               :is-ascending="isAscending"
               :sort-options="activeTabSortOptions"

app/assets/javascripts/members/components/filter_sort/sort_dropdown.vue

@@ -79,6 +79,7 @@ export default {
   <gl-sorting
     class="gl-display-flex"
     dropdown-class="gl-w-full"
+    block
     data-testid="members-sort-dropdown"
     :text="activeOptionLabel"
     :is-ascending="isAscending"

app/assets/javascripts/organizations/groups_and_projects/components/app.vue

@@ -200,6 +200,7 @@ export default {
           <gl-sorting
             class="gl-display-flex"
             dropdown-class="gl-w-full"
+            block
             :text="sortText"
             :is-ascending="isAscending"
             :sort-options="$options.sortItems"

app/assets/javascripts/packages_and_registries/settings/project/components/packages_protection_rules.vue

@@ -1,12 +1,19 @@
 <script>
 import { GlButton, GlCard, GlTable, GlLoadingIcon, GlKeysetPagination } from '@gitlab/ui';
 import packagesProtectionRuleQuery from '~/packages_and_registries/settings/project/graphql/queries/get_packages_protection_rules.query.graphql';
+import { getPackageTypeLabel } from '~/packages_and_registries/package_registry/utils';
 import SettingsBlock from '~/packages_and_registries/shared/components/settings_block.vue';
 import PackagesProtectionRuleForm from '~/packages_and_registries/settings/project/components/packages_protection_rule_form.vue';
-import { s__ } from '~/locale';
+import { s__, __ } from '~/locale';
 
 const PAGINATION_DEFAULT_PER_PAGE = 10;
 
+const ACCESS_LEVEL_GRAPHQL_VALUE_TO_LABEL = {
+  DEVELOPER: __('Developer'),
+  MAINTAINER: __('Maintainer'),
+  OWNER: __('Owner'),
+};
+
 export default {
   components: {
     SettingsBlock,
@@ -38,9 +45,11 @@ export default {
       return this.packageProtectionRulesQueryResult.map((packagesProtectionRule) => {
         return {
           col_1_package_name_pattern: packagesProtectionRule.packageNamePattern,
-          col_2_package_type: packagesProtectionRule.packageType,
+          col_2_package_type: getPackageTypeLabel(packagesProtectionRule.packageType),
           col_3_push_protected_up_to_access_level:
-            packagesProtectionRule.pushProtectedUpToAccessLevel,
+            ACCESS_LEVEL_GRAPHQL_VALUE_TO_LABEL[
+              packagesProtectionRule.pushProtectedUpToAccessLevel
+            ],
         };
       });
     },
@@ -91,7 +100,6 @@ export default {
         first: PAGINATION_DEFAULT_PER_PAGE,
       };
     },
-
     onPrevPage() {
       this.packageProtectionRulesQueryPaginationParams = {
         before: this.packageProtectionRulesQueryPageInfo.startCursor,

app/models/project.rb

@@ -561,6 +561,7 @@ class Project < ApplicationRecord
       delegate :enforce_auth_checks_on_uploads, :enforce_auth_checks_on_uploads=
       delegate :warn_about_potentially_unwanted_characters, :warn_about_potentially_unwanted_characters=
       delegate :code_suggestions, :code_suggestions=
+      delegate :duo_features_enabled, :duo_features_enabled=
     end
   end
 
@@ -3246,11 +3247,6 @@ class Project < ApplicationRecord
   end
   strong_memoize_attr :instance_runner_running_jobs_count
 
-  def code_suggestions_enabled?
-    code_suggestions && (group.nil? || group.code_suggestions)
-  end
-  strong_memoize_attr :code_suggestions_enabled?
-
   # Overridden in EE
   def allows_multiple_merge_request_assignees?
     false
@@ -3266,6 +3262,11 @@ class Project < ApplicationRecord
     false
   end
 
+  # Overridden in EE
+  def code_suggestions_enabled?
+    false
+  end
+
   private
 
   # overridden in EE

app/serializers/admin/abuse_report_details_entity.rb

@@ -21,9 +21,6 @@ module Admin
         expose :email do |report|
           report.user.confirmed?
         end
-        expose :phone do |report|
-          report.user.phone_number_validation.present? && report.user.phone_number_validation.validated?
-        end
         expose :credit_card do |report|
           report.user.credit_card_validation.present?
         end

bin/secpick

@@ -35,16 +35,25 @@ module Secpick
       "#{@options[:version]}-#{STABLE_SUFFIX}-ee"
     end
 
-    def git_commands
+    def git_pick_commands
       [
         fetch_stable_branch,
         create_backport_branch,
-        cherry_pick_commit,
+        cherry_pick_commit
+      ]
+    end
+
+    def git_push_commands
+      [
         push_to_remote,
         checkout_original_branch
       ]
     end
 
+    def git_commands
+      git_pick_commands + git_push_commands
+    end
+
     def gitlab_params
       {
         issuable_template: 'Security Release',
@@ -72,7 +81,36 @@ module Secpick
         puts "\nMerge request params:".blue
         pp gitlab_params
       else
-        cmd = git_commands.join(' && ')
+        cmd = git_pick_commands.join(' && ')
+        stdin, stdout, stderr, wait_thr = Open3.popen3(cmd)
+
+        puts stdout.read&.green
+        puts stderr.read&.red
+
+        unless wait_thr.value.success?
+          puts <<~MSG
+            It looks like cherry pick failed!
+            Open a new terminal and fix the conflicts.
+            Once fixed run `git cherry-pick --continue`
+
+            After you are done, return here and continue. (Press n to cancel)
+
+            Ready to continue? (Y/n)
+          MSG
+
+          unless ['', 'Y', 'y'].include?(gets.chomp)
+            puts "\nRemaining git commands:".blue
+            puts 'git cherry-pick --continue'
+            puts git_push_commands.join("\n")
+            exit 1
+          end
+        end
+
+        stdin.close
+        stdout.close
+        stderr.close
+
+        cmd = git_push_commands.join(' && ')
         stdin, stdout, stderr, wait_thr = Open3.popen3(cmd)
 
         puts stdout.read&.green

db/docs/deployment_approvals.yml

@@ -4,9 +4,24 @@ classes:
 - Deployments::Approval
 feature_categories:
 - continuous_delivery
-description: >-
-  Stores the user that approved/rejected a deployment and which approval rule was used.
-  See https://docs.gitlab.com/ee/ci/environments/deployment_approvals.html for more details.
+description: Stores the user that approved/rejected a deployment and which approval
+  rule was used. See https://docs.gitlab.com/ee/ci/environments/deployment_approvals.html
+  for more details.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74932
 milestone: '14.6'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+desired_sharding_key:
+  project_id:
+    references: projects
+    backfill_via:
+      parent:
+        foreign_key: deployment_id
+        table: deployments
+        sharding_key: project_id
+        belongs_to: deployment

db/docs/deployment_merge_requests.yml

@@ -7,4 +7,19 @@ feature_categories:
 description: https://docs.gitlab.com/ee/ci/environments/index.html#track-newly-included-merge-requests-per-deployment
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/18755
 milestone: '12.5'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+desired_sharding_key:
+  project_id:
+    references: projects
+    backfill_via:
+      parent:
+        foreign_key: deployment_id
+        table: deployments
+        sharding_key: project_id
+        belongs_to: deployment

db/docs/dora_daily_metrics.yml

@@ -8,4 +8,19 @@ feature_categories:
 description: Stores daily snapshots of DORA4 metrics per environment.
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/55473
 milestone: '13.10'
-gitlab_schema: gitlab_main
+gitlab_schema: gitlab_main_cell
+allow_cross_joins:
+- gitlab_main_clusterwide
+allow_cross_transactions:
+- gitlab_main_clusterwide
+allow_cross_foreign_keys:
+- gitlab_main_clusterwide
+desired_sharding_key:
+  project_id:
+    references: projects
+    backfill_via:
+      parent:
+        foreign_key: environment_id
+        table: environments
+        sharding_key: project_id
+        belongs_to: environment

db/migrate/20240124212938_add_duo_features_enabled_to_project_settings.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class AddDuoFeaturesEnabledToProjectSettings < Gitlab::Database::Migration[2.2]
+  enable_lock_retries!
+
+  milestone '16.9'
+
+  def change
+    add_column :project_settings, :duo_features_enabled, :boolean, default: true, null: false
+  end
+end

db/schema_migrations/20240124212938

@@ -0,0 +1 @@
+1ab3946da575910f8ae9ab220d1e1da61619b66a9ad09a7c2a90c2abda5056d9

db/structure.sql

@@ -22750,6 +22750,7 @@ CREATE TABLE project_settings (
     pages_multiple_versions_enabled boolean DEFAULT false NOT NULL,
     allow_merge_without_pipeline boolean DEFAULT false NOT NULL,
     code_suggestions boolean DEFAULT true NOT NULL,
+    duo_features_enabled boolean DEFAULT true NOT NULL,
     CONSTRAINT check_1a30456322 CHECK ((char_length(pages_unique_domain) <= 63)),
     CONSTRAINT check_3a03e7557a CHECK ((char_length(previous_default_branch) <= 4096)),
     CONSTRAINT check_3ca5cbffe6 CHECK ((char_length(issue_branch_template) <= 255)),

doc/api/projects.md

@@ -2639,6 +2639,27 @@ Returned object:
 }
 ```
 
+## Download a project avatar
+
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144039) in GitLab 16.9.
+
+Get a project avatar.
+You can access this endpoint without authentication if the project is publicly accessible.
+
+```plaintext
+GET /projects/:id/avatar
+```
+
+| Attribute | Type              | Required | Description           |
+| --------- | ----------------- | -------- | --------------------- |
+| `id`      | integer or string | yes      | ID or [URL-encoded path](rest/index.md#namespaced-path-encoding) of the project. |
+
+Example:
+
+```shell
+curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/4/avatar"
+```
+
 ## Remove a project avatar
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/92604) in GitLab 15.4.

doc/ci/yaml/index.md

@@ -3103,7 +3103,7 @@ can use that variable in `needs:pipeline` to download artifacts from the parent
 **Additional details**:
 
 - The `pipeline` attribute does not accept the current pipeline ID (`$CI_PIPELINE_ID`).
-  To download artifacts from a job in the current pipeline, use [`needs`](#needsartifacts).
+  To download artifacts from a job in the current pipeline, use [`needs:artifacts`](#needsartifacts).
 
 #### `needs:optional`
 

doc/development/ai_features/duo_chat.md

@@ -216,7 +216,7 @@ GitLab Duo Chat is enabled in the [Staging](https://staging.gitlab.com) and
 [Staging Ref](https://staging-ref.gitlab.com/) GitLab environments.
 
 Because GitLab Duo Chat is currently only available to members of groups in the
-Ultimate tier, Staging Ref may be an easier place to test changes as a GitLab
+Premium tier, Staging Ref may be an easier place to test changes as a GitLab
 team member because
 [you can make yourself an instance Admin in Staging Ref](https://handbook.gitlab.com/handbook/engineering/infrastructure/environments/staging-ref/#admin-access)
 and, as an Admin, easily create licensed groups for testing.

doc/user/group/manage.md

@@ -450,7 +450,7 @@ for the ability to set merge request approval rules for groups is tracked in
 ## Enable Experiment and Beta features
 
 DETAILS:
-**Tier:** Ultimate
+**Tier:** Ultimate, Premium
 **Offering:** SaaS
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/118222) in GitLab 16.0.
@@ -460,6 +460,9 @@ WARNING:
 (for example, the results might be low-quality, incomplete, incoherent, offensive, or insensitive,
 and might include insecure code or failed pipelines).
 
+NOTE:
+[GitLab Duo Chat](../../user/gitlab_duo_chat.md) is an only feature available in Premium tier.
+
 You can give all users in a top-level group access to Experiment and Beta features.
 This setting [cascades to all projects](../project/merge_requests/approvals/settings.md#settings-cascading)
 that belong to the group.

lib/api/api.rb

@@ -297,6 +297,7 @@ module API
         mount ::API::PagesDomains
         mount ::API::PersonalAccessTokens::SelfInformation
         mount ::API::PersonalAccessTokens
+        mount ::API::ProjectAvatar
         mount ::API::ProjectClusters
         mount ::API::ProjectContainerRepositories
         mount ::API::ProjectDebianDistributions

lib/api/entities/project.rb

@@ -41,7 +41,6 @@ module API
         end
       end
 
-      expose :code_suggestions, documentation: { type: 'boolean' }
       expose :packages_enabled, documentation: { type: 'boolean' }
       expose :empty_repo?, as: :empty_repo, documentation: { type: 'boolean' }
       expose :archived?, as: :archived, documentation: { type: 'boolean' }

lib/api/project_avatar.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module API
+  class ProjectAvatar < ::API::Base
+    feature_category :groups_and_projects
+
+    params do
+      requires :id, types: [String, Integer], desc: 'ID or URL-encoded path of the project'
+    end
+    resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
+      desc 'Download a project avatar' do
+        detail 'This feature was introduced in GitLab 16.9'
+        tags %w[project_avatar]
+        success code: 200
+      end
+      get ':id/avatar' do
+        avatar = user_project.avatar
+
+        not_found!('Avatar') if avatar.blank?
+
+        header(
+          'Content-Disposition',
+          ActionDispatch::Http::ContentDisposition.format(
+            disposition: 'attachment',
+            filename: avatar.filename
+          )
+        )
+
+        present_carrierwave_file!(avatar)
+      end
+    end
+  end
+end

package.json

@@ -61,7 +61,7 @@
     "@gitlab/favicon-overlay": "2.0.0",
     "@gitlab/fonts": "^1.3.0",
     "@gitlab/svgs": "3.83.0",
-    "@gitlab/ui": "^74.0.0",
+    "@gitlab/ui": "^74.2.0",
     "@gitlab/visual-review-tools": "1.7.3",
     "@gitlab/web-ide": "^0.0.1-dev-20240206230318",
     "@mattiasbuelens/web-streams-adapter": "^0.1.0",

spec/factories/projects.rb

@@ -609,15 +609,15 @@ FactoryBot.define do
     files { { 'README.md' => 'Hello World' } }
   end
 
-  trait :with_code_suggestions_enabled do
+  trait :with_duo_features_enabled do
     after(:create) do |project|
-      project.project_setting.update!(code_suggestions: true)
+      project.project_setting.update!(duo_features_enabled: true)
     end
   end
 
-  trait :with_code_suggestions_disabled do
+  trait :with_duo_features_disabled do
     after(:create) do |project|
-      project.project_setting.update!(code_suggestions: false)
+      project.project_setting.update!(duo_features_enabled: false)
     end
   end
 end

spec/frontend/packages_and_registries/settings/project/settings/components/packages_protection_rules_spec.js

@@ -71,8 +71,8 @@ describe('Packages protection rules project settings', () => {
       packagesProtectionRuleQueryPayload().data.project.packagesProtectionRules.nodes.forEach(
         (protectionRule, i) => {
           expect(findTableRow(i).text()).toContain(protectionRule.packageNamePattern);
-          expect(findTableRow(i).text()).toContain(protectionRule.packageType);
-          expect(findTableRow(i).text()).toContain(protectionRule.pushProtectedUpToAccessLevel);
+          expect(findTableRow(i).text()).toContain('npm');
+          expect(findTableRow(i).text()).toContain('Maintainer');
         },
       );
     });

spec/models/project_spec.rb

@@ -9195,6 +9195,14 @@ RSpec.describe Project, factory_default: :keep, feature_category: :groups_and_pr
     it { is_expected.to be_falsy }
   end
 
+  describe '#code_suggestions_enabled?' do
+    let(:project) { build_stubbed(:project) }
+
+    subject(:code_suggestions_enabled?) { project.code_suggestions_enabled? }
+
+    it { is_expected.to be_falsy }
+  end
+
   private
 
   def finish_job(export_job)

spec/requests/api/project_attributes.yml

@@ -180,6 +180,8 @@ project_setting:
     - encrypted_product_analytics_configurator_connection_string
     - encrypted_product_analytics_configurator_connection_string_iv
     - product_analytics_configurator_connection_string
+    - code_suggestions
+    - duo_features_enabled
 
 build_service_desk_setting: # service_desk_setting
   unexposed_attributes:

spec/requests/api/project_avatar_spec.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::ProjectAvatar, feature_category: :groups_and_projects do
+  def avatar_path(project)
+    "/projects/#{ERB::Util.url_encode(project.full_path)}/avatar"
+  end
+
+  describe 'GET /projects/:id/avatar' do
+    context 'when the project is public' do
+      let(:project) { create(:project, :public, :with_avatar) }
+
+      it 'retrieves the avatar successfully' do
+        get api(avatar_path(project))
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.headers['Content-Disposition'])
+          .to eq(%(attachment; filename="dk.png"; filename*=UTF-8''dk.png))
+      end
+
+      context 'when the avatar is in object storage' do
+        before do
+          stub_uploads_object_storage(AvatarUploader)
+
+          project.avatar.migrate!(ObjectStorage::Store::REMOTE)
+        end
+
+        it 'redirects to the file in object storage' do
+          get api(avatar_path(project))
+
+          expect(response).to have_gitlab_http_status(:found)
+          expect(response.headers['Content-Disposition'])
+            .to eq(%(attachment; filename="dk.png"; filename*=UTF-8''dk.png))
+        end
+      end
+
+      context 'when the project does not have an avatar' do
+        let(:project) { create(:project, :public) }
+
+        it 'returns :not_found' do
+          get api(avatar_path(project))
+
+          expect(response).to have_gitlab_http_status(:not_found)
+          expect(response.body).to eq(%({"message":"404 Avatar Not Found"}))
+        end
+      end
+
+      context 'when the project is in a group' do
+        let(:project) { create(:project, :in_group, :public, :with_avatar) }
+
+        it 'returns :ok' do
+          get api(avatar_path(project))
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+      end
+
+      context 'when the project is in a subgroup' do
+        let(:project) { create(:project, :in_subgroup, :public, :with_avatar) }
+
+        it 'returns :ok' do
+          get api(avatar_path(project))
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+      end
+    end
+
+    context 'when the project is private' do
+      let(:project) { create(:project, :private, :with_avatar) }
+
+      context 'when the user is not authenticated' do
+        it 'returns :not_found' do
+          get api(avatar_path(project))
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+
+      context 'when the project user is authenticated' do
+        context 'and have access to the project' do
+          let(:owner) { create(:user) }
+
+          before do
+            project.add_owner(owner)
+          end
+
+          it 'retrieves the avatar successfully' do
+            get api(avatar_path(project), owner)
+
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+
+        context 'and does not have access to the project' do
+          it 'returns :not_found' do
+            get api(avatar_path(project), create(:user))
+
+            expect(response).to have_gitlab_http_status(:not_found)
+          end
+        end
+      end
+    end
+  end
+end

spec/serializers/admin/abuse_report_details_entity_spec.rb

@@ -48,11 +48,7 @@ RSpec.describe Admin::AbuseReportDetailsEntity, feature_category: :insider_threa
         :notes_count
       )
 
-      expect(user_hash[:verification_state].keys).to match_array([
-        :email,
-        :phone,
-        :credit_card
-      ])
+      expect(user_hash[:verification_state].keys).to include(:email, :credit_card)
 
       expect(user_hash[:past_closed_reports][0].keys).to match_array([
         :created_at,

yarn.lock

@@ -1321,10 +1321,10 @@
   resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.83.0.tgz#5d6799e5fe3fb564b7e4190d90876469bd1608ba"
   integrity sha512-881f6OsxREgBXYn9fkg+XGweBFbrGdrssrIzFIZFSG95GF/K+HILw1mXZ9nq7C5Xb5JDWPKJGYnKuHw5vvWm5Q==
 
-"@gitlab/ui@^74.0.0":
-  version "74.0.0"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-74.0.0.tgz#bc751dd5232b060f44253750c0896c4d86073b5e"
-  integrity sha512-Jyznf60p0adGROy60pwrcSe9ABm+7wf23vxYoqaCoL4gcqqZOgvQnuesB1ce2/BAAd8LMr1SII2Z6H4V68sWAw==
+"@gitlab/ui@^74.2.0":
+  version "74.2.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-74.2.0.tgz#520bbf06eddd0da61cd79bd5678b610ecfd291ef"
+  integrity sha512-bSYWZ9tlzl8oX57Xou2aQN4bnEVzEr/vzBqGpdpTizjsf3RF4K3BHhD2CuRXex3AwFYxQX89QIO5LZKlX2KhrA==
   dependencies:
     "@floating-ui/dom" "1.4.3"
     bootstrap-vue "2.23.1"